--- title: I ditched Keycloak for a single-container SSO, and the... description: A homelab user replaces Keycloak with Pocket ID, a lightweight single-container, passkey-first OIDC provider, to implement SSO across self-hosted services.... canonical: https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I ditched Keycloak for a single-container SSO, and the integration headaches explained everything | daily.dev og:description: A homelab user replaces Keycloak with Pocket ID, a lightweight single-container, passkey-first OIDC provider, to implement SSO across self-hosted services.... og:url: https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx og:image: https://api.daily.dev/og/posts/wVKrXK7Zx.png og:image:alt: I ditched Keycloak for a single-container SSO, and the integration headaches explained everything og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I ditched Keycloak for a single-container SSO, and the integration headaches explained everything **[XDA Developers](https://daily.dev/sources/xda-developers)** · 5 min read · 1 upvotes · 1 comments ## Summary A homelab user replaces Keycloak with Pocket ID, a lightweight single-container, passkey-first OIDC provider, to implement SSO across self-hosted services. Integration proved uneven: Jellyfin required a third-party OIDC plugin, a Pushed Authorization Requests checkbox fix, and correcting an HTTP/HTTPS redirect mismatch caused by TLS termination at the reverse proxy; Nextcloud worked smoothly via its native user_oidc app; Immich silently created a duplicate account instead of matching the existing one. Jellyfin's mobile apps still can't use SSO since it lacks official OIDC support, leaving Quick Connect as the only mobile workaround. The takeaway: 'supports SSO' means different things per application, and reverse proxy handshake details, identity claim matching, and native client support all need individual verification. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does Jellyfin's SSO login fail with 'invalid_request - Failed to push authorization parameters' when using Pocket ID? This error occurs because Pocket ID requires Pushed Authorization Requests (PAR) by default, but Jellyfin's SSO plugin doesn't enable PAR support out of the box. The fix is a checkbox setting inside Jellyfin's SSO plugin configuration that enables PAR support, which then lets the login handshake succeed. _Homelabbers wiring up self-hosted OIDC providers can find fixes like this shared on daily.dev before hitting the same wall._ ### Why did Immich create a duplicate account instead of logging into my existing account after enabling OIDC through Pocket ID? Immich can silently create a new account when the OIDC identity claim from the provider doesn't match the existing user's identity, without showing any error from either Pocket ID or Immich. The original account and its media remain intact, but users end up logged into a fresh empty account instead. Verifying identity claim matching before enabling OIDC on an existing service prevents this. _Anyone rolling out SSO across self-hosted apps like Immich watches for these silent identity-matching pitfalls via daily.dev._ ### Does Jellyfin support OIDC single sign-on on its mobile apps? No, Jellyfin has no official OIDC support, so SSO login through an identity provider like Pocket ID only works in the browser. Mobile and other native Jellyfin clients cannot use the SSO flow at all, leaving Quick Connect as the only practical workaround for signing in on those apps. _Those planning SSO for media servers can weigh client-support gaps like this one through daily.dev before rolling it out._ ## Similar posts on daily.dev - [Pocket ID: Easy Passkey Authentication](https://daily.dev/posts/pocket-id-easy-passkey-authentication-32uo1bmkp) · Lobsters · 0 upvotes · 0 comments - [Self-Hosted Human and Machine Identities in Keycloak 26.4](https://daily.dev/posts/self-hosted-human-and-machine-identities-in-keycloak-26-4-qbyrik6nv) · CNCF · 0 upvotes · 0 comments - [Granular Policy Enforcement in Quantum Secure Discovery Services](https://daily.dev/posts/granular-policy-enforcement-in-quantum-secure-discovery-services-qgjun5wgp) · Security Boulevard · 1 upvotes · 0 comments - [Federated Identity vs. Single Sign-On: Key Differences](https://daily.dev/posts/federated-identity-vs-single-sign-on-key-differences-5zfmmxhch) · Auth0 · 0 upvotes · 0 comments --- Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#authentication](https://daily.dev/tags/authentication), [#self-hosting](https://daily.dev/tags/self-hosting), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I ditched Keycloak for a single-container SSO, and the integration headaches explained everything","url":"https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx"},"datePublished":"2026-08-21T17:04:19.478Z","dateModified":"2026-09-14T06:30:59.431Z","description":"A homelab user replaces Keycloak with Pocket ID, a lightweight single-container, passkey-first OIDC provider, to implement SSO across self-hosted services....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a707d9c662f3e3eae999f90f7d2eb23c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a707d9c662f3e3eae999f90f7d2eb23c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"infrastructure,authentication,self-hosting,oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I ditched Keycloak for a single-container SSO, and the integration headaches explained everything"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-ditched-keycloak-for-a-single-container-sso-and-the-integration-headaches-explained-everything-wvkrxk7zx#faq","mainEntity":[{"@type":"Question","name":"Why does Jellyfin's SSO login fail with 'invalid_request - Failed to push authorization parameters' when using Pocket ID?","acceptedAnswer":{"@type":"Answer","text":"This error occurs because Pocket ID requires Pushed Authorization Requests (PAR) by default, but Jellyfin's SSO plugin doesn't enable PAR support out of the box. The fix is a checkbox setting inside Jellyfin's SSO plugin configuration that enables PAR support, which then lets the login handshake succeed. Homelabbers wiring up self-hosted OIDC providers can find fixes like this shared on daily.dev before hitting the same wall."}},{"@type":"Question","name":"Why did Immich create a duplicate account instead of logging into my existing account after enabling OIDC through Pocket ID?","acceptedAnswer":{"@type":"Answer","text":"Immich can silently create a new account when the OIDC identity claim from the provider doesn't match the existing user's identity, without showing any error from either Pocket ID or Immich. The original account and its media remain intact, but users end up logged into a fresh empty account instead. Verifying identity claim matching before enabling OIDC on an existing service prevents this. Anyone rolling out SSO across self-hosted apps like Immich watches for these silent identity-matching pitfalls via daily.dev."}},{"@type":"Question","name":"Does Jellyfin support OIDC single sign-on on its mobile apps?","acceptedAnswer":{"@type":"Answer","text":"No, Jellyfin has no official OIDC support, so SSO login through an identity provider like Pocket ID only works in the browser. Mobile and other native Jellyfin clients cannot use the SSO flow at all, leaving Quick Connect as the only practical workaround for signing in on those apps. Those planning SSO for media servers can weigh client-support gaps like this one through daily.dev before rolling it out."}}]} ```